Privacy policy

Account: your email address, optional display name and password (stored only in hashed form by our authentication provider).

Content: the images you upload, the prompts you write, and the generated assets, animations and exports — private, in your own space.

Transactions: your purchase and credit history. Payments are processed by Stripe; your card number never passes through our servers.

Technical data: your approximate country at signup and a cryptographic fingerprint (SHA-256 hash) of the IP address — never the raw address — for anti-abuse purposes, plus internal usage events (page views, clicks on key buttons).

No advertising cookies, no third-party trackers, no selling of data. Our analytics are first-party and cookie-free: each visit is counted through an anonymous fingerprint that rotates daily (you cannot be tracked from one day to the next), referring sites are reduced to their domain only, and raw visit data is deleted after 90 days — only aggregate statistics (visitors per day, per country, per source) are kept. The only cookies used are strictly necessary: your session and your language preference.

Your images and assets are never used to train AI models — neither by us nor, by contractual instruction, by our providers.

To provide the service (generate, store and deliver your assets), bill your purchases, prevent fraud and abuse, send transactional emails (welcome, recaps, password resets) and improve the product. That's all.

To run a conversion or an animation, the image involved is transmitted to our model provider (xAI) for the duration of processing. Intermediate video clips are automatically purged from our temporary storage after 24 hours.

We rely on: Supabase (database, storage, authentication), Railway (application hosting), Stripe (payments), xAI (image and video generation) and Resend (email).

These providers host their infrastructure primarily in the United States: your information is therefore communicated outside Québec and Canada, with appropriate contractual protections.

Your data is kept while your account is active. Temporary video clips are deleted within 24 hours; technical logs are time-limited. Upon account deletion, your personal information and content are removed within a reasonable time, except what the law requires us to keep (billing records).

In accordance with Québec's Law 25, you may request access to your information, its rectification or deletion, or withdraw your consent. Write to bonjour@lassetier.com — we reply within 30 days.

If you believe your rights are not being respected, you may file a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Encryption in transit (HTTPS everywhere), API keys stored only in hashed form, strict per-account data isolation at the database level, logged administrative access.

No system is infallible: in the event of a confidentiality incident presenting a risk of serious harm, we will notify you and the Commission d'accès à l'information, as required by law.

The service is not intended for children under 14 and we do not knowingly collect their information.

This policy may be updated; the date at the top controls. Questions: bonjour@lassetier.com.